Wonde - Data Processing Agreement (V1.0)

1 DATA Processing AGREEMENTT hisdataprocessingagreementrecordstheterm suponwhichWondeLimited( Wonde )willprocesstheSchoolDataforthepurposeof transferringtheSchoolDatatoWonde sapplicationsand/ortooneormorethirdparty applicationprovidersofservicesorproducts totheSchoolandthisAgreementis therefore formed between Wonde and the , THE SCHOOL this Agreement the following definitions shall apply: Agreement means this Data Processing Agreement . AuthorisedPersons shallmeanthepersonsorcategoriesofpersons thattheSchoolauthorisestogiveWondeproces singinstructions pursuant to this Agreement . ConfidentialInformation meansallconfidentialinformation(howeverr ecordedorpreserved) | 01/2022 | Data hasthemeaninggivenintheDataProtectionLaw sasamended or replaced from time-to-time. Data Controller shallbeinterpretedandconstruedbyreferenc etotheterm Controller as defined under Data Protection Laws. Data Processor shallbeinterpretedandconstruedbyreferenc etotheterm Processor as defined under Data Protection Laws.

2 Data ProtectionLaws meansallapplicabledataprotectionandpriva cylegislationinforcefromtimetotimeintheU KincludingtheDataProtectionAct2018( DPA )(asamendedorreplacedfromtime-to-time),U KGDPR(asdefinedintheDataProtectionAct201 8)andthePrivacyandElectronicCommunicatio nsRegulations2003(SI2003/2426)asamendeda ndallotherlegislationandregulatoryrequir ementsinforcefromtimetotimewhichapplytoa partyrelatingtotheuseofPersonalData(incl uding,withoutlimitation,theprivacyofelec troniccommunications);andtheguidanceandc odesofpracticeissuedbytheInformationComm issionerorotherrelevantregulatoryauthori tyand applicable to a party. Effective Date meansthedateuponwhichtheSchoolacceptsthe seterms. Good IndustryPractice meansusingstandards,practices,methodsand proceduresconformingtothelawandexercisin gthatdegreeofskillandcarediligencepruden ceandforesightwhichwouldreasonablyandord inarilybeexpectedfromaskilledandexperien cedpersonorbodyengagedinasimilartypeofun dertakingunderthe same or similar | 01/2022 | MIS meanstheSchool sdatabasewhichholdstheSchoolData.

3 Personal Data has the meaning given in Data Protection Laws. Personal DataBreach hasthemeaninggiveninDataProtectionLawsbu tshall include any breach of School processed or Processing has the meaning given in Data Protection Laws. School meanstheschooloreducationestablishmentus ingthe Wonde Software. School Data meansPersonalDatarelatingtostudents,pare ntsandguardians,andstaffattheSchool,ando therdataregarding the school, including but not limited and contact details; of birth; data; ; records; , call and year group information. School Suppliers meansthirdpartyprovidersofservicesorprod uctsviathirdpartyapplicationstotheSchool towhichtheSchoolwishestotransfercertaind atasetsoftheSchool | 01/2022 | Services Means the services performed by ,utilisingtheWondeSoftware,oftransferrin gselectedSchoolDatafromtheSchooloritsMIS toselectedSchool Suppliers; ,parentsandguardians,andstaffattheSchool toaccessselecteddatafromtheMISand/orScho olSuppliersusingasingleaccountwithinthe Wonde Software; allow access to, and use of the Wonde Software.

4 StandardContractualClauses (SCC) meansallControllertoProcessorSCCs,anyCon trollertoControllerSCCsoranyotherSCCstha tmayapplyandareenteredintobetweenthepart iesortheEuropeanCommission sSCCsforthetransferofPersonalDatapursuan ttotheEuropeanCommission sdecision (C92010)593) of 5 February 2010. Sub-Processors meansanythird-party,personorcompanyappoi ntedbyoronbehalfofWondewhomayprocessPers onalDatatofacilitatetheprovisionoftheSer vicesinconnection with the Agreement . UK GDPR meanstheGeneralDataProtectionRegulation, Regulation(EU)2016/679,asitformspartofdo mesticlawintheUnitedKingdombyvirtueofsec tion3oftheEuropeanUnion(Withdrawal)Act20 18(includingasfurtheramendedormodifiedby thelawsoftheUnitedKingdomorofapartoftheU nitedKingdomfromtimeto time). Wonde Software meansthesoftwareapplicationsandplatforms upplied(directlyorindirectly)byWondeandu sedbytheSchool including the Wonde school | 01/2022 | reference towritingorwrittenincludes emails and writing in anyelectronic Effective Date of this Agreement shall be the date that the SchoolacceptsthetermsofthisAgreementandt heSchoolacknowledgesthatthisAgreementsha llbeeffectiveandreplaceanypreviouslyappl icabledata Processing , handling and security is subject to the Data Protection (someorallof)theSchoolDatatoWondeandtheW onde Software , the School agrees to the terms of this School and Wonde acknowledge that, for the purposes of DataProtection Laws, Wonde is a Data Processor and the School is a DataControllerinrespectoftheSchoolDataco mprisingPersonalDatawhichisprocessed by the Wonde Software.

5 Each party shall comply with theirrespective obligations under the Data Protection ,includingdetailsofstaffoftheSchoolwhent heyinteractwithWondedirectly, scollectionandhandlingofPersonalDataisou tlinedinitsPrivacyNotice,whichismadeavai labletotheSchoolandisfurtheravailable on Wonde s website or by obligations for the Processing of the School (unlesssuchprocessingshallberequiredbyan yapplicablelawto which Wonde is subject to).Wo-DPA | 01/2022 | the purpose ,whichpermitsstudents,parentsandguardian s,andstaffoftheSchooltoaccess and manage the School Data effectively; out requests and/or instructionsto restrict or approvedata sets via the Wonde school portal; providing the School with access to the Wonde Software; otherwise reasonably necessary for theprovision of theServices by Wonde to the Data to Wonde for the purpose of Wonde Processing the SchoolDataassetoutinthisclause2,islawful under,andinfullcompliancewith, ,claims,damages,expenses,lossesandliabil itiesincurredbyWondearisingout of or in connection with any breach of the foregoing warranty ,duration, ,theorganisationandre-categorisationofth atSchoolData,thetransferoftheSchoolDatat oSchoolSuppliersnotifiedtoWondebytheScho olviatheWondeschoolportal,theprocessingo fSchoolDatawithinandforthepurposeoftheWo ndeSoftware,andthetransferoftheSchoolDat atoparents,guardians,studentsandstaffoft heSchool who are permitted access to the Wonde Software;Wo-DPA | 01/2022 | to provide the Services.

6 ,andthedatasubjectswillbestudentsoftheSc hool,theirparentsandguardians, and staff of the and ,andshallcontinueinfullforceunlessandunt iltheSchoolremovestheWondeSoftwarefromth eSchool scomputernetworkorMIS,atwhichpointthisAg reementshallautomatically , , ,4and5and9shallcontinue to ,inordertoprotecttheSchoolData,willremai ninfullforce and of School ,forthepurposeofextractingandtransferrin gsuchSchoolData to Wonde and to School (viaHTTPS)theSchoolData will be encrypted by the Wonde ;subjecttoanytermsandconditions of use for the online | 01/2022 | School to the school portal in the Wonde ,inthetermsrequiredbytheDataProtectionLa ws,beforeinstructingWondetotransferanySc hoolDatatosuch School ,theSchoolhassoleresponsibilityforensuri ngthatadequatesafeguardsareinplaceforthe transferofthatSchoolData,asrequiredbyDat aProtectionLaws,toajurisdictionoutsideof theUnitedKingdom(including,ifapplicable, writtenagreementsincorporatingtheappropr iate SCCs).

7 ,andhasreceivedallconsentsandrightsneces saryundertheDataProtectionLawstoenableWo ndetoprocess the School ,theSchoolacknowledgesandagreesthatitwil lbesolelyresponsiblefor(i)theaccuracy,qu ality,andlegalityoftheSchoolDataandtheme ansbywhichithasbeenacquired;(ii)complyin gwithallnecessarytransparencyandlawfulne ssrequirementsundertheDataProtectionLaws forthecollectionanduseoftheSchoolData;(i ii)ensuringtheSchoolhastherighttotransfe rorprovideWondeaccesstotheSchoolDataforp rocessingunderthisAgreement;(iv)ensuring thattheSchool sinstructionstoWondecomplywithapplicable lawsincludingtheDataProtection ,claims,damages,expenses,lossesandliabil itiesincurredbyWondearisingoutoforinconn ection with any breach of the clauses , , and/or School Data shall always remain the property of the | 01/2022 | ,includingbutnotlimitedto,providinganyre quirednoticesandobtaininganyrequiredcons ents, to the extent it is held or processed outside of Wonde s shall of performing the Services it provides to the School; ,exceptasexpresslypermittedbythisAgreeme nt,orasrequiredforthepurposeofanyService sprovidedbyWondeto the School, or to the extent required by School Data in place in respect of preserving the School Data.

8 Handling of the School of the ,thecostsofimplementationandthenature,sc ope,contextandpurposesofprocessingtobeca rriedoutbyWonde,aswellastheriskofvarying likelihoodandseverityfortherightsandfree domsofnaturalpersons,Wondeshallinrelatio ntotheWo-DPA | 01/2022 | to ensure a level of security appropriate to that ,Wondeshalltakeaccountinparticularofther isksthatarepresentedbyprocessingoftheSch oolData,inparticularfromaPersonalDataBre achandtopreservethesecurityandconfidenti alityoftheSchoolData,inaccordancewithWon de ssecuritypoliciesandprocesses are available on and International will continue to update this list when required to do ,solongasWondecarriesoutduediligenceonal lpotentialSub-Processors,complieswiththe requirementsundertheDataProtectionLawsan dcomplies with clause ,itshallensurethatthearrangementbetweeni tandtheSub-Processorisgovernedbyawritten contractincludingtermswhichofferatleastt hesamelevelofprotectionfortheSchoolDataa sthosesetoutinthisAgreement, which meets the requirements of Data Protection , ,10,11astheyapplytoprocessingoftheSchool DatacarriedoutbythatSub-Processor, | 01/2022 | ,withoutobtainingtheSchool's specific prior written consent, provided to adequacy regulations under the Data ProtectionLawsthattheterritoryprovidesad equateprotectionfortheprivacyrights of individuals; participates in a valid cross-border transfer mechanismunder Data Protection Laws, so that Wonde (and, whereappropriate, the School) can ensure that appropriate safeguardsare in place to ensure an adequate level of protection withrespect to the privacy rights of individuals as required by the UKGDPR.

9 Transfer otherwise complies with Data Protection any School Data transfer between Wonde and the School requiresexecution ofSCCs in order to comply with the Data Protection Laws, ,andshallproduceacopyofsuchpolicytotheSc hoolifrequested to do or return of School ,ortheterminationofthisAgreement, | 01/2022 | ,theSchoolmayinitsabsolutediscretionbywr ittennotice to Wonde at any time require Wonde format as is reasonably notified by the School to Wonde ; request within 30 days of receiving such ,providedthatWondeanditsSub-Processorssh allensuretheconfidentialityofallsuchScho olDataretained,andshallensurethatsuchSch oolDataisonlyprocessedasnecessaryforthep urpose(s)specifiedbytheapplicablelawsreq uiringitsstorage and for no other ,within30daysofaformalrequestfromtheScho ol, and Information to clauses , and , Wonde scompliancewiththisAgreement; ,includinginspections,bytheSchooloranyau ditornominatedbytheSchoolinrelationtothe Processing of the School Data by Wonde and its to the extent required by Data Protection | 01/2022 | ,andshall(andshallensurethatanynominated auditorshall)avoidcausing(or,ifitcannota void,minimise)anydamage,injuryordisrupti ontoWonde soritsSub-Processors premises, equipment, personnel and ,WondeoritsSub- and authority; outside normal business hours at those premises; Subject Rights and Associated ,Wondeshall(andshalluseallreasonableende avourstoprocurethatitsSub-Processorsshal l)assisttheSchoolbyimplementingappropria tetechnicalandorganisationalmeasures,ins ofarasthisispossible,forthefulfilmentoft heSchool sobligations,torespondtorequeststoexerci sedata subject rights under the Data Protection of School Data; 'scompliancewiththeDataProtection Laws.

10 ,andshalluseallreasonableendeavourstoens urethattheSub-Processordoesnot,respondto anyrequestfromadatasubject,Wo-DPA | 01/2022 | laws to which Wonde or the Sub-Processor is subject ,unintendeddestructionordamage,corruptio n, Data at its own expense as soon as possible; ,unauthorisedorunlawfulprocessingoftheSc hoolData; Personal Data BreachinrespectofanySchoolDataprocessedb yWonde,providingtheSchoolwithsufficienti nformationtoallowtheSchooltomeetanyoblig ationstoreport,orinformtheindividualstow hichtheSchoolDatarelated, sOfficeoranyotherappropriateregulatoryau thority, where :assistingintheinvestigation,facilitatin ganyinterviews,remediationandmakinganyre cordsavailableinrelationtoanysuchPersona lDataBreachreferredtoinclause (attheSchool sexpense) to any request from a Data Subject; ,andpriorconsultationswithcompetentdatap rivacyauthorities,whichtheSchoolreasonab lyconsiderstoberequiredunderanyDataProte ctionLaws,ineachcasesolelyinrelationtopr ocessingofSchoolDatacomprisedintheSchool Data,byandtakingintoaccountthenatureof the Processing and information available to | 01/2022 | ,whetherarisingincontract,tort(including negligence),breachofstatutorydutyorother wise,fororinconnection ,interceptionorcorruptionofanydata;other thantotheextentsuch loss is caused by the negligence or fault of Wonde ; ,interceptionorcorruptionofanydataresult ingfromanynegligenceordefaultbyanyprovid eroftelecommunicationsservices to Wonde , the School or any School Supplier; ; to reputation or goodwill.